rogers.interac.qkvkervke.co.uk Open in urlscan Pro
50.116.74.27 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://rogers.interac.qkvkervke.co.uk/bank/atb/
Submission: On December 26 via automatic, source openphish (December 26th 2018, 8:00:25 pm UTC)

Summary HTTP 21 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 21 HTTP transactions. The main IP is 50.116.74.27, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is rogers.interac.qkvkervke.co.uk.

This is the only time rogers.interac.qkvkervke.co.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ATB Financial (Banking)

Domain & IP information

	IP Address		AS Autonomous System
15	50.116.74.27 50.116.74.27		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
1	2a00:1450:400... 2a00:1450:4001:815::2008		15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:81d::200e		15169 (GOOGLE) (GOOGLE - Google LLC)
21	4

15 50.116.74.27 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: hel.heliosshield.net

rogers.interac.qkvkervke.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	qkvkervke.co.uk rogers.interac.qkvkervke.co.uk	1 MB
2	google-analytics.com www.google-analytics.com	17 KB
1	googletagmanager.com www.googletagmanager.com	31 KB
21	3

	Domain	Requested by
15	rogers.interac.qkvkervke.co.uk	rogers.interac.qkvkervke.co.uk
2	www.google-analytics.com	rogers.interac.qkvkervke.co.uk
1	www.googletagmanager.com	rogers.interac.qkvkervke.co.uk
21	3

This site contains no links.

Subject Issuer	Validity	Valid
*.google-analytics.com Google Internet Authority G3	`2018-12-04` - `2019-02-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Frame ID: 8163BFB679CDCC5BB7069462CEB679CE
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^google_tag_manager$/i

Typekit (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

env /^Typekit$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

21
Requests

14 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

1256 kB
Transfer

1357 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 19

http://www.google-analytics.com/r/collect?v=1&_v=j67&a=312377282&t=pageview&_s=1&dl=http%3A%2F%2Frogers.interac.qkvkervke.co.uk%2Fbank%2Fatb%2F&ul=en-us&de=UTF-8&dt=Welcome%20to%20ATB%20Online&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABE~&jid=1331048275&gjid=344077458&cid=205890135.1545854390&tid=UA-537010-68&_gid=2117623375.1545854390&_r=1&gtm=G4rPHHNRF&z=795618000 HTTP 307
https://www.google-analytics.com/r/collect?v=1&_v=j67&a=312377282&t=pageview&_s=1&dl=http%3A%2F%2Frogers.interac.qkvkervke.co.uk%2Fbank%2Fatb%2F&ul=en-us&de=UTF-8&dt=Welcome%20to%20ATB%20Online&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABE~&jid=1331048275&gjid=344077458&cid=205890135.1545854390&tid=UA-537010-68&_gid=2117623375.1545854390&_r=1&gtm=G4rPHHNRF&z=795618000

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
rogers.interac.qkvkervke.co.uk/bank/atb/ 32 KB
32 KB 576ms
445ms Document
text/html 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: fffe11162e31140fdef1634356cd0a4944e84be9803bdafcd032e326ca5ed606

Request headers

Host: rogers.interac.qkvkervke.co.uk
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:47 GMT
Server: Apache
Last-Modified: Fri, 11 May 2018 21:25:59 GMT
Accept-Ranges: bytes
Content-Length: 32993
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET 0832.js
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 0
0

GET
H/1.1 200
OK analytics.js Show response
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 34 KB
35 KB 1372ms
119ms Script
application/javascript 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/analytics.js
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:49 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 35175

GET
H/1.1 200
OK gtm.js Show response
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 63 KB
63 KB 127ms
126ms Script
application/javascript 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/gtm.js
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 1aa631b7334bf31e1895b6323166e7395da566daa84b2306f7d10d803d0cb0d8

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:49 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=91
Content-Length: 64023

GET
H/1.1 200
OK commonScripts_D8041FBA7F6BE8E6DB4D9BA2033E3D1A.js Show response
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 427 KB
427 KB 599ms
119ms Script
application/javascript 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/commonScripts_D8041FBA7F6BE8E6DB4D9BA2033E3D1A.js
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 182bcf0b9132cf7234bb8661aa95fd1ccfbe5382b847dbdbbba40aaa69095d3b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:48 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 436779

GET
H/1.1 200
OK qia1usm.js Show response
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 18 KB
18 KB 1130ms
119ms Script
application/javascript 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/qia1usm.js
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 62dce705e9c805154e4a3f639b212b39a78bfff6c3da54d4eefa7756fb951578

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:49 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 18496

GET
H/1.1 200
OK publicScripts_BB370365945C5CC150F3847916C7A67F.js Show response
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 2 KB
3 KB 1252ms
119ms Script
application/javascript 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/publicScripts_BB370365945C5CC150F3847916C7A67F.js
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: f75e9e828d89462f2e9a93cee9de296e877df758b361f4eb80ba9c7971ffe4c9

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:49 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 2414

GET
H/1.1 200
OK fonts.css
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 100 KB
101 KB 235ms
119ms Stylesheet
text/css 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/fonts.css
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: bc1d20c0f75e6882604dc25043446dcdf17c5634c98b56a667b2c56779b83b5a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:48 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 102888

GET
H/1.1 200
OK commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 281 KB
281 KB 1198ms
956ms Stylesheet
text/css 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 68f2754a833a25d7b577b98dbd1995d2ee46122c912750991b6e0e2aac71f809

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:49 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 287580

GET publicStyles_B4C3D7BDA526D6057A111A01AA17270B.css
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 0
0

GET
H/1.1 200
OK header-gradient.jpg
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 760 B
1002 B 119ms
119ms Image
image/jpeg 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/header-gradient.jpg
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 72da7b996e10c7a2a69be39a1a403fbc0eea85182551d12c1b47e02821a86411

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:49 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=90
Content-Length: 760

GET DESGetFiles.aspx
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 0
0

GET
H/1.1 200
OK DESGetFiles(1).aspx Show response
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 70 KB
71 KB 120ms
119ms Script
text/plain 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/DESGetFiles(1).aspx
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 385869883cbe19d8cd31410e7328bb6c2050ee2697115fa20c93bcbf512886ea

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:49 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 72016

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 111 KB
31 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:815::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PHHNRF

Requested by

Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:815::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

c375c4eb5a45ddb141070d255732a78f6a9384752dc623f054adf5940e7ef09c

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 26 Dec 2018 19:59:49 GMT
content-encoding: gzip
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
server: Google Tag Manager (scaffolding)
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 31812
x-xss-protection: 1; mode=block
expires: Wed, 26 Dec 2018 19:59:49 GMT

GET
H/1.1 200
OK error.gif
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 129 B
370 B 121ms
120ms Image
image/gif 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/error.gif
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 205c6b68b92fd475a63ba98b6e120351ae70d3e3b7572523bb9ebd1727b0e42f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Cookie: _ga=GA1.3.205890135.1545854390; _gid=GA1.3.2117623375.1545854390; _gat_UA-537010-68=1
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:50 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=89
Content-Length: 129

GET
H/1.1 200
OK CMP-d6f65bfd-b895-dc34-53ed-c11bf2d04e31.jpg
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 67 KB
68 KB 121ms
120ms Image
image/jpeg 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/CMP-d6f65bfd-b895-dc34-53ed-c11bf2d04e31.jpg
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 56abc55fbd5d9aba5424a7bba3e0a3eba228ee2ca14f86bb05a857dd669ea7cf

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Cookie: _ga=GA1.3.205890135.1545854390; _gid=GA1.3.2117623375.1545854390; _gat_UA-537010-68=1
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:50 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=88
Content-Length: 68909

GET
H/1.1 200
OK banner1.js Show response
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 478 B
732 B 119ms
118ms Script
application/javascript 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/banner1.js
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 782e67c903301b3bd7f6b2f4d52a34063f1c2222794aa98cc687bfd36ab72f5a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:49 GMT
Last-Modified: Fri, 11 May 2018 21:12:44 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 478

GET
H/1.1 200
OK saved_resource Show response
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 49 KB
50 KB 123ms
122ms Script
text/plain 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/saved_resource
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 5840ad8d7a0972a7c381916a877238b12d271117a52aa0182a5676002792ce5c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:49 GMT
Last-Modified: Fri, 11 May 2018 21:12:45 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 50628

GET
H/1.1 200
OK Asset.php Show response
rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/ 58 KB
58 KB 125ms
125ms Script
text/html 50.116.74.27
Unified Layer

General

Check archive.org

Show headers Download Go to

Full URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/Asset.php
Requested by: Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Protocol: HTTP/1.1
Server: 50.116.74.27 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS: hel.heliosshield.net
Software: Apache /
Resource Hash: 5b94927d18f63dce5fa286fd779ad8700c1f2d78de4b698c8749a754b56b93a9

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rogers.interac.qkvkervke.co.uk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
Cookie: _ga=GA1.3.205890135.1545854390; _gid=GA1.3.2117623375.1545854390; _gat_UA-537010-68=1
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 26 Dec 2018 19:59:50 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=87
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81d::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/gtm.js

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 05 Nov 2018 21:10:09 GMT
server: Golfe2
age: 2729
date: Wed, 26 Dec 2018 19:14:21 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 17404
expires: Wed, 26 Dec 2018 21:14:21 GMT

GET
H2

200

collect
www.google-analytics.com/r/
Redirect Chain

http://www.google-analytics.com/r/collect?v=1&_v=j67&a=312377282&t=pageview&_s=1&dl=http%3A%2F%2Frogers.interac.qkvkervke.co.uk%2Fbank%2Fatb%2F&ul=en-us&de=UTF-8&dt=Welcome%20to%20ATB%20Online&sd=2...
https://www.google-analytics.com/r/collect?v=1&_v=j67&a=312377282&t=pageview&_s=1&dl=http%3A%2F%2Frogers.interac.qkvkervke.co.uk%2Fbank%2Fatb%2F&ul=en-us&de=UTF-8&dt=Welcome%20to%20ATB%20Online&sd=...

35 B
101 B

15ms
14ms

Image
image/gif

2a00:1450:4001:81d::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j67&a=312377282&t=pageview&_s=1&dl=http%3A%2F%2Frogers.interac.qkvkervke.co.uk%2Fbank%2Fatb%2F&ul=en-us&de=UTF-8&dt=Welcome%20to%20ATB%20Online&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABE~&jid=1331048275&gjid=344077458&cid=205890135.1545854390&tid=UA-537010-68&_gid=2117623375.1545854390&_r=1&gtm=G4rPHHNRF&z=795618000

Requested by

Host: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://rogers.interac.qkvkervke.co.uk/bank/atb/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Dec 2018 19:59:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://www.google-analytics.com/r/collect?v=1&_v=j67&a=312377282&t=pageview&_s=1&dl=http%3A%2F%2Frogers.interac.qkvkervke.co.uk%2Fbank%2Fatb%2F&ul=en-us&de=UTF-8&dt=Welcome%20to%20ATB%20Online&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAEABE~&jid=1331048275&gjid=344077458&cid=205890135.1545854390&tid=UA-537010-68&_gid=2117623375.1545854390&_r=1&gtm=G4rPHHNRF&z=795618000
Non-Authoritative-Reason: HSTS

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/0832.js

Domain: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/publicStyles_B4C3D7BDA526D6057A111A01AA17270B.css

Domain: rogers.interac.qkvkervke.co.uk
URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/DESGetFiles.aspx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ATB Financial (Banking)

92 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| dataLayer function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| getRandomPort function| BlackberryLocationCollector function| detectFields function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector function| UIEvent function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath function| convertTimestampToGMT function| getTimestampInMillis function| debug object| ProxyCollector object| TimestampCollector object| UIEventCollector object| BrowserDetect string| SEP string| PAIR string| DEV string| HTML5 string| BLACKBERRY string| UNDEFINED string| GEO_LOCATION_DEFAULT_STRUCT object| geoLocator boolean| geoLocatorStatus function| popupWindow function| openInvoiceImageWindow function| printField function| getBaseDomain function| HideMxTargetsWhenNoAd function| CloseifParentWindowIsClosed function| EditNick function| CancelEditNick function| ClearAllNickNames function| receiveExtendSession function| extendSession function| RedirectToShoppingCart function| GetMiniSpendingWidgetUrl string| strParentWindowURL function| CreateXmlHttp function| PopulateCreditor function| HandleCreditorResponse function| StartProgressDisplay function| EndProgressDisplay function| DisplayErrorMessage function| SetDataEntryVisible function| SearchPayee function| AddPayee undefined| XmlHttp string| AjaxCreditorPageName string| CREDITOR_SEARCH_QUERYSTRING_KEY function| $ function| jQuery object| jQuery1111030824694220491056 object| TelerikControls function| forceIE89Synchronicity function| MoneyDesktopWidgetLoader object| MDAnalytics object| Typekit function| ga object| gaplugins object| google_tag_manager string| GoogleAnalyticsObject object| gaGlobal object| gaData object| google_tag_data

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: http://rogers.interac.qkvkervke.co.uk/bank/atb/index_perso_files/qia1usm.js(Line 32) Message: Typekit: the domain "rogers.interac.qkvkervke.co.uk" isn't in the list of published domains for kit "qia1usm".

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

rogers.interac.qkvkervke.co.uk
www.google-analytics.com
www.googletagmanager.com
rogers.interac.qkvkervke.co.uk
2a00:1450:4001:815::2008
2a00:1450:4001:81d::200e
50.116.74.27
182bcf0b9132cf7234bb8661aa95fd1ccfbe5382b847dbdbbba40aaa69095d3b
1aa631b7334bf31e1895b6323166e7395da566daa84b2306f7d10d803d0cb0d8
205c6b68b92fd475a63ba98b6e120351ae70d3e3b7572523bb9ebd1727b0e42f
2218bbf47b340278b7b696dbe3af4eed89edffa709c19abd6747b18147c3a675
385869883cbe19d8cd31410e7328bb6c2050ee2697115fa20c93bcbf512886ea
56abc55fbd5d9aba5424a7bba3e0a3eba228ee2ca14f86bb05a857dd669ea7cf
5840ad8d7a0972a7c381916a877238b12d271117a52aa0182a5676002792ce5c
5b94927d18f63dce5fa286fd779ad8700c1f2d78de4b698c8749a754b56b93a9
62dce705e9c805154e4a3f639b212b39a78bfff6c3da54d4eefa7756fb951578
68f2754a833a25d7b577b98dbd1995d2ee46122c912750991b6e0e2aac71f809
72da7b996e10c7a2a69be39a1a403fbc0eea85182551d12c1b47e02821a86411
782e67c903301b3bd7f6b2f4d52a34063f1c2222794aa98cc687bfd36ab72f5a
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255
bc1d20c0f75e6882604dc25043446dcdf17c5634c98b56a667b2c56779b83b5a
c375c4eb5a45ddb141070d255732a78f6a9384752dc623f054adf5940e7ef09c
f75e9e828d89462f2e9a93cee9de296e877df758b361f4eb80ba9c7971ffe4c9
fffe11162e31140fdef1634356cd0a4944e84be9803bdafcd032e326ca5ed606